Vulnerabilities

TI-2023-05851 CVE-2023-6375 · GHSA-35q6-5v8g-78c6

Tyler Technologies Magistrate Court Case Management Plus stores backups insecurely

LOW 35

Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00997 Published 2023-11-30 No fix listed CWE-552

TI-2023-05833 CVE-2023-6354 · GHSA-vq53-8c3w-p2fr

Tyler Technologies Magistrate Court Case Management Plus PDFViewer.aspx allows authentication bypass

MEDIUM 42

Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFViewer.aspx 'filename' parameter.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00991 Published 2023-11-30 No fix listed CWE-287

TI-2023-05832 CVE-2023-6353 · GHSA-qh68-5xq4-9pr9

Tyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypass

MEDIUM 48

Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.aspx 'enky' parameter.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00991 Published 2023-11-30 No fix listed CWE-287

TI-2023-05823 CVE-2023-6344 · GHSA-53f9-2x58-9gff

Improper authentication in Tyler Technologies Court Case Management Plus

LOW 32

Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx 'ifolder' parameter.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00935 Published 2023-11-30 Fixed in ~2023-11-01 CWE-287

TI-2023-05822 CVE-2023-6343 · GHSA-frqc-q27w-5p4j

Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server tssp.aspx allows authentication bypass

LOW 32

Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx 'FN' and 'PN' parameters.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00935 Published 2023-11-30 Fixed in ~2023-11-01 CWE-287

TI-2023-05821 CVE-2023-6342 · GHSA-r8pw-p7q7-5244

Tyler Technologies Court Case Management Plus "pay for print" allows authentication bypass

MEDIUM 50

Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzldk=' and 'payforprint_CM/Redirector.ashx?userid=' parameters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0113 Published 2023-11-30 Fixed in ~2023-11-01 CWE-287